Latest / 10X AI with Julius Neil / AI Voice Cloning & Cybersecurity: Can You Trust What You Hear? | Robert Siciliano
Transcript
- Julius Neil Buenconsejo: Good day everyone, we now have again another episode of 10xAI. I have here Robert Siliano. Robert Siliano, can you introduce yourself to our viewers and listeners right now and give them about the background, your experiences, yeah. Robert Siciliano ProtectNowLLC: Sure. So I first and foremost I'm from Boston, Massachusetts, USA, and I've been providing security awareness training for the past thirty years, which essentially is understanding how to manage risk when it comes to violence and theft in both the physical and virtual worlds. Julius Neil Buenconsejo: so when you say about violence, can you elaborate on that? Because I know there's theft, there are some other security, but what is the violence when it comes to cyber world? Robert Siciliano ProtectNowLLC: Well, you know, today we see people engaged in self-harm. we see people broadcasting active shooting, and certainly Julius Neil Buenconsejo: Mm, yeah. Robert Siciliano ProtectNowLLC: there's cyberbullying as well. And so I deal with all aspects of digital literacy and how technology affects the quality of our lives and the security of our personal and professional lives. Julius Neil Buenconsejo: So you've been working with enterprise companies as well. So if I gave a company incredible cybersecurity technology stack, so for example, but its employees were still vulnerable to manipulation, so how secure would that company actually be? Robert Siciliano ProtectNowLLC: So when we are vulnerable to digital manipulation, you know, essentially you're as strong as the weakest link in the chain, so to speak. And when the employees can be manipulated over the phone, via text, voicemail, email, even a pop-up or a Zoom call. there's liability there, there's vulnerability there. And so getting the employees up to speed as to what to look out for, but first and foremost, how to they themselves be what I call a strategic human firewall, recognizing risk proactively, that's what's necessary in order for them to be able to manage all of the risks that are coming at them regularly. Julius Neil Buenconsejo: Okay, so how do you do that in your trainings for example? How do you ensure that the people or the trainees are trained to spot for example, cyber security, know, some theft or other things that you know that is what became that will become vulnerable in the company. Robert Siciliano ProtectNowLLC: So interestingly, most training today revolves around explaining: okay, these are the issues. This is what you're supposed to do in response. Do this and don't do that, or else these are the repercussions. And generally, humans don't really learn all that effectively when they are being told what to do. They would prefer to make decisions on their own. Come to their own realizations as to how the information affects them personally. So the way in which I train is I engage in a series of questions. We have a dialogue. We have communication. You know, it's a, it's a, it's a, it's a me engaging in a conversation with my audience, asking them a number of belief-challenging questions to get them to the point where they go, That's how that works. I didn't realize that. I want more of that in my life. And before you know it, they are actively wanting more security, both personally and professionally. Julius Neil Buenconsejo: so for example, that was for example in an email, but now in an AI, in an AI cybersecurity when you cannot even spot which is real or not, how are you going to train them with that? Robert Siciliano ProtectNowLLC: So AI, of course, has stripped away the clumsy red flags of traditional fraud. In the past, criminals relied on what we call blunder force phishing, which is mass-blasting emails riddled with scamagrammar. Today, generative AI allows for high precision impersonation at scale. Criminals now use neuropuppetry to create perfect lies. And by scraping, of course, seconds of audio and video from social media, they use voice cloning and AI deep fakes. To impersonate a trusted source. And so, in order to understand what's happening to you when you receive that deep fake audio, video, voice clone, and so forth, we engage in and I explain how to become that strategic human firewall by utilizing what is called the triple A protocol. And the triple Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: A protocol is your break the fake playbook. So triple A is analyze, authenticate, and then analyze. Act essentially recognizing the manufactured urgency, which is prevalent in most scams. The moment a request demands secrecy or immediate action, I tell them it's important to stop that your brain is moved into emotional reaction, take a breath and move back into analytical thinking. And then from there, authenticate. Essentially Identifying that digital mask, treating every digital communication as a potential breach, essentially looking for the technical and biological red flags of a deep fake. And finally, the third thing is act, essentially execute what we call out-of-band verification, which means never using the contact information provided in the suspicious message, essentially hanging up and calling the person back on a trusted pre-validated number that you know is legitimate. Wait a minute. Julius Neil Buenconsejo: Yeah, like for example, in a corporate setting, so I'm an employee and then my boss went to a vacation, so everything is also social media right now. So these are the hackers and wanted to get some private information about the company. So I have a secretary and then there's a voice clone and also, you know, the deep fakes. And then they call this secretary and said, okay. I want you to transfer this amount of money to this account now because I'm now trapped in the island. I cannot go anywhere. So how would you do that? Because everybody can now impersonate because everybody's posting on Instagram. I'm now in this beach. I'm doing, you know, I'm having a luxury trip to Bali or whatever. So how do you do that now with the search search of urgency? Because most of the hackers, most of these phishing companies, usually before, they create that urgency. And that relationship for example in a corporate world, when your boss, and you know your boss is so strict about this, and you have to comply right away, how are you going to use the AAA? Robert Siciliano ProtectNowLLC: So today with AI and deep fakes and really truly any financial trap Transactions that occur today, there needs to be an out of band verification. In other words, even if you're a bookkeeper, even if you're an accountant, even if you're in payroll for that matter, that there should be some type of a dialogue that before a financial transaction is made, there needs to be a checking in, an out of band verification. You know, again, never using the contact information provided, actually picking up the phone or even knocking on that colleagues door in the office building and saying, Hey, do you approve of this request? Even if it is the COO or the CEO. Especially if, you know, there's some type of an issue that, you know, I'm on vacation, I lost my wallet, or I lost my passport, or money needs to be moved quickly. Again, that manufactured urgency that you spoke to, there needs to be dialogue right now that says don't just obey the orders, so to speak. Call back at a predetermined number that you know is Legitimate to confirm the validity of the request. Julius Neil Buenconsejo: so for example, so for some private files or private information of the company, so when they use their own personal cloud, their own post personal chat, GPT or whatever tool that they're using, how do you train them not to use that in terms of, you know what I mean? Robert Siciliano ProtectNowLLC: Well, the companies have access to a number of different AI LLMs or tools that essentially when using an LLM, that the information that is contained or added to that LLM is contained within the organization. In other words, third party services that whose job it is to make sure that that data doesn't go out to the general LLM for everybody else to learn from, so to speak. And it's tools like that that should be incorporated internally so that the the employee knows that it's the only one they're allowed to use when it comes to engaging in any special requests with sensitive information. Julius Neil Buenconsejo: so in terms of now there is a grokbot and then there is dot by OpenAI. So how would cybersecurity affect the using of these agents, the bots? Robert Siciliano ProtectNowLLC: So the AI agents themselves, the way in which the employees are using those tools. There should be some dialogue with your CIO, your CTO, your CISO as to how the information for that particular AI agent is being used and how that could compromise company data, proprietary information, or even the network itself. Each AI agent that's deployed by an organization, by an enterprise, it needs to go through compliance. Julius Neil Buenconsejo: so in terms of compliance, maybe you heard about this Muse, the Muse agent of Facebook and there's one business owner who used Muse and then he just automated that and that Muse agent gave all the information of the owner, the address of the owner and then sent something out for delivery to that customer. How can you do that in terms of the digital way, not in the personal way? having said that, do you think humans now are the weakest link in cybersecurity or are we looking at the problem completely wrong? Robert Siciliano ProtectNowLLC: Humans are a part of the problem. They're not being trained properly to use the tools in which they have access to on a regular basis. Most humans, when it comes to security vulnerabilities, managing risk, don't necessarily think that if their job isn't actually security, then the security of the company network isn't actually their responsibility. And while they're trained on, say, phishing simulation training as one aspect of what to look out for, they're not trained holistically. On managing risk in the bigger picture. So, for example, most employees are using the same passcode across multiple accounts. Most employees Julius Neil Buenconsejo: Yeah. Robert Siciliano ProtectNowLLC: aren't using two-factor authentication in both their personal and professional lives. And so by actually training the employee on all aspects of security awareness, not just phishing simulation training, you're in a better position to have a more secure employee inside the network, engaging in i managing risk effectively versus an employee that is only told, this is what fishing looks like, you do this, you don't do that, or else. Julius Neil Buenconsejo: so two factor authentication. Is it also hackable, this system? Is there a way to hack that? Robert Siciliano ProtectNowLLC: Generally Two factor authentication is compromised in one of two ways. Either on the network level, there's some type of a vulnerability in the technology deploying that, and there's backdoor access as a result of that vulnerability. That isn't usually the case. Most companies, most organizations, if they're engaging in effective patch management, they should be fine. Usually, the most significant vulnerability in two factor authentication is what we would consider a man in the middle attack. And a man in the middle attack is when Somebody actually engages that recipient of that second factor, that phone call, that email, that text, that pop-up, and they act as, say, the IT director or the CIO, the CTO. And they Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: say, Hey, I need that one-time text message in order to get access to the network. What is it? It's that man in the middle attack, that bad actor posing as that company officer that is the path of least resistance for compromising multi-factor other. Authentication. Julius Neil Buenconsejo: If you Robert Siciliano ProtectNowLLC: yeah. it happened with Uber. a few years back, Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: an employee at Uber actually had received a phone call from somebody who he thought or an e or a text message from somebody he thought was the IT director and asked for that secondary code. And he gave it up. Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: And as a result, it compromised the network. Julius Neil Buenconsejo: So you've spent decades studying human behavior and security. When did you realize that technology wasn't the real problem? Robert Siciliano ProtectNowLLC: Yeah, so I've been vested in this, you know, since the mid-90s. And I've come to believe over the years, by speaking to thousands and thousands of people, that we all possess what I call the human blind spot. And the human blind spot is our psychological and truly our biological instinct. It's in our it's in our DNA to trust each other, to trust what's familiar to us. And ultimately, it's that cognitive gap where biological trust truly all Overrides what we would call digital suspicion, leaving the door wide open for all kinds of enhanced deception and fraud. Human beings are what is considered an interdependent species. And as an interdependent species, it means that we are dependent upon each other for our survival. And ultimately, that means that, you know, man needs woman and woman needs man to procreate. And the basis of procreation means that we need to trust each other. And so in the digital age, right, phone calls, emails, text messages, pop-ups, Zoom calls, we need to trust that the person we're in communication with is, you know, worthy of our Trust. But the problem is that too many of them aren't. And so it is that human blind spot. That is being weaponized against us. And even when somebody's lying to us, our DNA truly wants to believe that lie. That's problematic. And until employees understand that true vulnerability about their own biology, and until companies begin to inform and educate those employees of that, then they're just going to continually believe that it can't happen to me, function in denial, and do nothing about security because they don't think it's gonna happen to them to begin with. Julius Neil Buenconsejo: what was the moment in your career when you realized humans were going to be the battleground for cyber security? Robert Siciliano ProtectNowLLC: You know, that actually has been going on for 30 plus years. I've known that for 30 plus years. I've been screaming that for 30 plus years. And you know, even 30 years ago, I would explain, okay, do all these different things and be aware of these different risks, and as long as you do these things, you'll be fine. But even that advice has never really been adhered to. Unless you precede the information with, okay, this is what biologically, psychologically makes you at risk. This is how and why manufactured urgency is used to get you to engage in what was what is called like cognitive tunnel vision, to get you to focus only on the information that's being expressed to you versus thinking outside of, okay, is this really happening? Is this really real? Is this a fraudster socially engineering me? I've seen that. Since day one. Most consumers don't understand that. Most CIOs and CTOs and CISOs, they certainly recognize that through phishing simulation training that they are deploying within their organizations. However, that fishing simulation training doesn't actually speak to that human doesn't truly understand and recognize risk because they don't understand their own biology. Julius Neil Buenconsejo: can you give me an example in one of your sessions or one of your consulting gigs that you go to this company and then you saw that vulnerability in that company? Robert Siciliano ProtectNowLLC: You know, I see this in almost every company that I work with. I ask a series of qualifying questions. questions that designed to get the employees to see kind of where they're at amongst their colleagues, right? Both personally and professionally. Simple questions like, you know, how many of you can honestly say that you're using a different passcode across all your critical accounts? Including personally and professionally. If I get 10% of the room to raise their hand that they're using a different passcode across critical accounts, that's a lot, which means 90% are using the same passcode everywhere. And then I explain to them and show them examples of the fact that this is as many as 25 billion with a B passwords on the dark web. 25 billion. And when I show them that in real time, like we can actually do searches and show their passwords on the dark web. Web, they're like, whoa, I had no idea. And now they're beginning to see specifically their own vulnerabilities. And I follow that up with, okay, so how many of you are using a password manager? And I might get 10% of the room to raise their hand. And I say, well, that means, you know, if 90% of you aren't using a password manager, then yeah, it makes sense you're using the same passcode across multiple accounts because you wouldn't be able to possibly remember all the different passcodes that you need across all. The dozens and dozens of different accounts that you probably possess. And you also probably have easy to guess and easy to hack passcodes like you know, one, two, three, four, five, six, and so forth. Julius Neil Buenconsejo: You Robert Siciliano ProtectNowLLC: And they begin to see how ridiculous it and they are in that regard, and how little and weak security they have. And once you get them to see it for themselves, they begin to go, This is why I'm supposed to have a different passcode across multiple accounts. There's, you know, 25 billion of my credentials out there and so on. And you get them to make those decisions for themselves, to be able to recognize their own limitations and risks and lack of digital literacy. And before you know it, they want more security in their life. Julius Neil Buenconsejo: Have you had the experience in AI Security Bridge? Robert Siciliano ProtectNowLLC: So Like everybody else, I'm seeing what's going on out there myself. I personally have not been affected in that way, other than, you know, I've received phone calls and emails and text messages that have all been enhanced utilizing deep fakes and voice cloning and getting rid of all the scam or grammar. I've seen it all already. It's being used in most, if not all, of the fraud that's being perpetrated towards me and everybody else. I've received those wrong number text messages. Messages and engaged in dialogue with those on the other end, usually people who are victims of human trafficking. I've gotten on WhatsApp video calls with those same perpetrators, again, being victims of human trafficking whose job it is 24 hours a day is cybercrime, and actually engaged in video calls with AI deep fakes, with using real humans with AI face overlay, where they're using pictures. pictures of someone else masking their own faces. And it's pretty alarming when you see that. The technology isn't perfect with the AI face overlay, but it's good enough that it could be considered, you know, the actual person that you're communicating with. Julius Neil Buenconsejo: How do you think cybersecurity will evolve with AI right now? Is there a pattern now that you see? Robert Siciliano ProtectNowLLC: Well, certainly it's a double edged sword. you know, Bill Gates and others have said that, you know, right now, AI has the capacity to shut down the electrical grid. That AI has the capacity to, you know, Express information for biological warfare that anybody could consume and you know decimate populations, you know, left and right. we know this and it's problematic. And is if the AI industry regulates either by self or intervention from you know government officials, which I think is ultimately necessary, and Bill Gates agrees, I think that you know we're heading for disaster unless you know, smart people, the smartest people in the room actually take responsibility for their technologies and do what's right. Julius Neil Buenconsejo: so that's one thing, know. Now, before this Claude, Chad GPT, and then I think Meta, wanted to have the AI governance, a regulatory government agency that will regulate them. But Ram, he doesn't want that. He wanted them to self-regulate. How is the cybersecurity or AI security governance will affect that? Robert Siciliano ProtectNowLLC: You know, the bad actors have access to LLMs that have been essentially jailbroken. And they're already using LLMs For ill-gotten gain, subscription services that anybody really can subscribe to for not a lot of money, and designed to for for research purposes that could truly do harm. I think that you know, in a society where you know we are capitalists, where there's money to be made through both, you know, bad actors and the good actors, the good guys, you know, black hats for. White hats, that you know, the smartest people in the room with access to the best technologies. I've I have confidence that you know we will tighten things up and secure our systems. I mean, look at I'm asked all the time, you know, who's winning? The good guys or the bad guys? I'm asked that question all the time. And the reality is, of course, the good guys are winning. Because if the good guys weren't winning, the grid would already be down. our financial systems would already be down. we wouldn't have clean running water. I mean if the good guys weren't winning, we'd already be in the dark. Julius Neil Buenconsejo: So you've gone to some extreme lengths to demonstrate security vulnerabilities including buying an ATM. So what were you trying to prove during that time? Robert Siciliano ProtectNowLLC: You know, an an ATM is such an analog device, you know. of course, you know, PayPal and Venmo, they're digital. digital transactions, right? Whereas an ATM, you know, you you put an actual physical card in. And I was looking for a bike for my kid online through Craigslist, which is like an online marketplace. And there was an ATM for sale. I was like, I did not even know you could buy an ATM online or in that regard. And so I purchased it simply because I could. And then when I bought it, the guy I bought it from had not cleared The ATM's digital logs, which means that The ATM had thousands of credit cards and debit card numbers on it, you know. So basically, I bought a data breach. And when you buy a data breach, or when somebody like me buys a data breach, it's kind of a big deal. And so the first thing I did was I called Fox News and they sent down a cameraman and a guy with a fuzzy mic and a reporter. And we deployed the ATM in downtown Boston, and people started to immediately use it. And we affixed a skimming device to it and a small wireless camera. People had no idea. we showed them what happened and how they were compromised, it made for some really good TV and it shows how even in a digital universe, you know, there are still plenty of analog vulnerabilities. That being said, Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: you know, people are generally trusting of all the technology in front of them, whether it's analog or digital for that matter. And It brought, you know, to people's attention that look at all you've got to be is a bit more aware, know what your options are, understand the risks, and you know, at a minimum at the ATM, just cover up the keypad with your other hand so it doesn't get your PIN code if there's a camera attached to it. Simple stuff that as long as you understand and recognize risk regularly, then you can thwart most security vulnerabilities. Julius Neil Buenconsejo: So that's one experiment. So what was the most surprising security experiment that you have ever conducted? Robert Siciliano ProtectNowLLC: We bought I I b I bought like thirty digital devices off of Facebook Marketplace and eBay. Used secondhand digital devices. I bought hard drives and laptops and desktops and mobile phones, all different, you know, everything from Apple and Microsoft's operating system to Androids. We we bought it all. I just Took them back to my office and I have a hacker, you know, somebody who is good at forensics, ran through all of the hardware, ran it through various software programs to see what data we could find. On 17 of 30 devices, we found enough information to steal identities and to compromise networks. We found active cookie sessions in some of those devices, which meant that we could use it to actually log into accounts. So between usernames and passcodes and all of the vulnerable information that we found on 17 devices, it shows that you know more than half were vulnerable. And I would say that most of us who engage in secondhand devices, either selling them on the secondhand marketplace or simply just turning them in. there's a lot of vulnerability there, both personally and professionally. Julius Neil Buenconsejo: on all of your experiment, so what is that findings that result genuinely shocked about your about? Robert Siciliano ProtectNowLLC: Yeah, that ultimately, you know, when it comes to our digital devices, when it comes to the information we have access to, when it comes to every inbound communication, most Humans, most employees, most people in general aren't effectively engaged in recognizing risk. That we truly don't want to think it can't happen to us. Security is not natural and it's not normal. So when we talk about the human blind spot, trusting by default, what that means is that I just trust people in general, that I don't generally verify anything, that I just want to believe and trust in my fellow human. That's generally what the human blind spot ultimately means. And so security is recognizing sociopaths, psychopaths, hardcore narcissists, basically predators that mean to do us harm. And human beings, we don't default to recognizing risk. We default to people are good and I trust them. And so as a result, we don't generally do what we can or should when it comes to managing risk. Many people don't even lock the doors of their homes. You know, most people don't even have a home security system. We don't do the one-on-one things. And as a result, that's problematic. So I think it's really important that we get back to basics when it comes to security awareness training so that the user, the employee, the consumer sees their physical vulnerabilities, you know, locking doors, personal protection, physical security, self-defense. And then you teach them about protecting their identities, managing their passcodes, knowing what to do every time the phone rings. And that's how you build a secure corporate culture by holistically informing and educating the employee on how to manage risk in their own personal lives first, so they are better employees to protect the network. Julius Neil Buenconsejo: in terms of, this is just a side question, in terms of devices, which is more secure, Android or iOS? Robert Siciliano ProtectNowLLC: Well, certainly IOS. there are, you know, thousands and thousands of viruses targeting iOS, but it's really hard to hack Apple's operating system. It's a closed system. Whereas with Android, it's an open system, meaning that developers have full-blown access to the Android OS similarly to how they have had access to Microsoft's operating system to create software around it. And that same software can be a virus. So Android needs antivirus similarly to how a Windows machine needs antivirus. There isn't a available antivirus for the IOS system because, you know, you just don't need it. Julius Neil Buenconsejo: So going back to the human blind spot. So what did this ATM experiment taught you about human security that technology couldn't? Robert Siciliano ProtectNowLLC: That people just kinda function, you know, based on habit. That you know, their habit is to go to the ATM on a regular basis. They don't necessarily make any effort to look for any vulnerabilities, they don't necessarily look around the perimeter of their body to see if anybody's paying any unwanted attention to them, whether to say either either mug or rob them, or even attaching a skimming device to the face of the ATM. They're not thinking of that at all. And as a result, there are plenty of you know. Vulnerabilities. There are plenty of muggings at ATMs. There are plenty of skimming devices at ATMs. And that is going to continue to happen. Julius Neil Buenconsejo: How do you spot a fake ATM for example? How do you spot in one area? Because for me, for example, as a normal person going into mall, going to outside and I wanted to withdraw money and then see it's ATM, it's like a trust. There's a trust already that ATM is going to work and it's secure. Then for me, how am I going to be able to know that this has security breach or something like it's a hacking device? Robert Siciliano ProtectNowLLC: So I would say, you know, every time you approach an ATM Look around the ATM to see if anybody's paying unwanted attention to you. And then look at the ATM itself where the card slot is. And on the card slot, if there is something protruding from the card slot that you could actually put your fingers around to and pop off, well, that's of course a skimming device. And then from there, looking around the perimeter of the keypad, right? Whether it's the monitor or the actual keypad itself, if there are any extruding devices that you could pop off that might. Have a camera in them, well, right there could be a vulnerability. So usually it's a two-part system. It's the external skimming device over the card slot, andor in addition to the actual camera that is monitoring your keystroke. So you you're when you enter on the keypad, your pin code. Look for two devices. If you can pop either one off, that ATM is compromised. Julius Neil Buenconsejo: so going back to the enterprise. So I'm pretty surprised as even though a lot of companies, big companies, Fortune 500 companies are spending a lot of money in cybersecurity and still, why is it incredibly vulnerable? Because of some one human decision or some other vulnerabilities in the system. Robert Siciliano ProtectNowLLC: Yeah, because you know, that th those humans aren't being taught How to manage risk in so many other aspects of their professional lives. They're only being taught how to manage and deal with, say, you know, phishing emails. And phishing emails are still, you know, a good 60 to 80% of all the vulnerabilities that most employees face regularly. But there are many others. And so, example, earlier we talked about a man in the middle attack with two-factor authentication. And that right there isn't something that is generally discussed in fishing simulation training. And as a result, that one vulnerability can give the bad actors access to the network. Julius Neil Buenconsejo: What do you think are the security leaders or the top management are failing to understand about how an ordinary employee perceives cybersecurity? Robert Siciliano ProtectNowLLC: Well, when they look at their fishing simulation training metrics and they're good. Like they might say, hey, you know, we did like ninety-eight or ninety-nine percent. That's fantastic. But that doesn't necessarily mean that 98 or 99% of the employees understand what it is that they did or didn't do. That just means that they just didn't do anything. They didn't click on any links. They didn't respond to anything. Because maybe, you know, they're just too afraid to do anything. And that might also mean that they're not actually doing their actual job. Because even in legitimate emails that are being sent to them by their colleagues, they're just not responding. They're just not reacting at all, which means a significant loss of productivity, which also affects the company's bottom line. So Unless they're actually properly holistically training their employees on true security awareness, not only are they, you know, looking at, you know, false positives or false metrics when it comes to their metrics in regards to fishing simulation training, there there's a significant reduction in productivity. Julius Neil Buenconsejo: Now have you seen this in bigger companies or smaller companies? Everywhere. Robert Siciliano ProtectNowLLC: Everywhere, across the board. Yeah. Julius Neil Buenconsejo: So let's move on to another topic the security theater. So what does that mean? Robert Siciliano ProtectNowLLC: security theater essentially is when For example, we put on a little bit of a you know, s security theater is putting on a little bit of a show. security theater is like providing fishing simulation training and saying, okay, we've done everything we're supposed to do to protect and secure the network. And it's like, well, maybe, but like all you're really doing is you know, you're you're essentially showing the employees that you're doing your job as a CISO and that You know, you've achieved the metrics that you need for your security budget for the COO to approve of. But that's not necessarily solving the problem. You're as a professional doing your job effectively, but not necessarily solving the actual problem that you're supposed to be solving, which is true security. Julius Neil Buenconsejo: So in a typical company, can you describe how do security data look like in an enterprise model? Robert Siciliano ProtectNowLLC: Evolving an organization beyond passive security theater by incorporating You know, the active defense of what I call a strategic human firewall is a necessary yet challenging step. So, what does that mean? Adding this, say, foundational biological layer is tactically a superior form of defense. And it demands you know, a bit more effort. It creates intentional friction, is what it does, in business workflows by forcing pauses, is what it does. Does. And it disrupts the comfort of relying solely on existing compliance metrics. Because, you know, this methodology requires, again, an intentional behavioral evolution, moving from passive compliance to active defense. It basically triggers a natural resistance from corporate leadership because they just want fishing simulation training. And here are like say, you know th this ultimately is is is what results in the employee becoming part of the solution versus part of the problem. Julius Neil Buenconsejo: so you mentioned about compliance. If a company for example is highly compliant, can they still be dangerously insecure? Robert Siciliano ProtectNowLLC: Yeah, compliance is a a a a significant problem in regards to if that's all you're trying to do, then Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: you know the current industry security standards rely entirely on Like basically the prefrontal cortex, so to speak, right? This part of your brain. the part of the brain responsible for logic, reasoning, complex planning. The fundamental assumption is if we give employees enough data, policies, compliance videos, simulating phishing results, they'll rationally apply that data when an attack occurs. That is biologically false. And the modern Julius Neil Buenconsejo: Mmm. Robert Siciliano ProtectNowLLC: human predator does not attack the pre-frontal cortex, they attack the amygdala, the amygdala, the brain's emotional epicenter and threat detector. And they accomplish this through, and you mentioned it earlier, manufactured urgency. And so when a criminal clones a CEO's voice or creates a realistic time-sensitive financial crisis, they are not initiating a cognitive debate. They're triggering a psychological fight-of-flight response. Adrenaline floods that person's brain, shutting down rational thought to prioritize immediate action. And that's action bias. So compliance is just, you know, checking a box and not necessarily solving the human. human problem of security. Julius Neil Buenconsejo: in your trainings, for example, when the employees completed all the trainings that you have done, and then how are you going to prove that their behavior actually changed afterwards? Robert Siciliano ProtectNowLLC: Yeah, so interestingly, the behavior the the the the ROI and the metrics actually show up in the fishing simulation training. So Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: once they've actually taken an effective Security awareness training that holistically engages the human where they're at in their own lives, both personally and professionally, you know, understanding what security actually is versus what it isn't. And when you when you actually engage that employee holistically in that regard, they begin to appreciate the value security has. And once they engage in the phishing simulation training, now they're actually looking at those emails. They're actually dissecting and determining what's real and what's It's fake. And they're actually getting better at it. And as they're getting, they're getting better at it because they care more about it. And ultimately, that's what you want your employees to do is care about security. Julius Neil Buenconsejo: how do you do that in a sustainable way? Like for example, after your training everybody cares about, cyber security and then after a while, six months, one year, you know, 18 months and suddenly people just say, I don't care because nothing happens. Robert Siciliano ProtectNowLLC: Well, so I think it's it's like this. You know, security fatigue is caused by the compliance trap, like we discussed, right? And when you bombard employees the complex and personal rules that trigger security aversion, it's a false sense of security felt by meeting those regulatory requirements while the human behavior remains unchanged and vulnerable. So if you go in and you actually change their behavior by affecting them, what happens as a result is what we call security appreciation. So security appreciation is when the employee takes what they learned at work and they bring it home and they teach it to their family around the truly around the kitchen table, so to speak, right? And we and we get what we call the kitchen table effect. And the kitchen table effect is ultimately when it solidifies that information in them for life. Like it becomes a part of who they are. Julius Neil Buenconsejo: yeah, it's a nice concept. So can you actually train someone to become harder to manipulate? This is a follow-up question with your Robert Siciliano ProtectNowLLC: Of course you can. Julius Neil Buenconsejo: training, yeah. Robert Siciliano ProtectNowLLC: Yeah, yeah, that that's the beauty of it. So you know most people when it comes to risk They only engage in managing it when something bad happens to them. And emotionally, they're kind of scarred from that. You know, they actually are, you know, hurt. There's trauma involved there. Whereas if you properly train them and you engage them in a dialogue and you get them to actually make those decisions for themselves, they become consciously aware and appreciate the value security actually has for them personally and professionally. And from that point on, they begin to look at the world a little bit differently. It's kind of like, you know. Somebody who engages in effective physical, mental health, you know, diet and exercise, and they begin to see results. Now they begin to change habits in their lives and they look at the world a little different around them and they begin to make better choices. It's the same thing in security. With effective training, you can actually get those same people to look at the world around them a little bit differently, and they begin to see and understand risk. risk as it's presents it's as it is presented to them. And that's where you know becoming a strategic human firewall is. You know, it's from that point on, they no longer just trust by default. The idea is between When becoming a strategic human firewall, they're blocking deception. They be they adopt a proactive governance, a mindset that turns them from passive targets into active detection layers. It's basically the shift from I trust what I see because of my human blind spot to I verify everything. Julius Neil Buenconsejo: so the strategic human firewall awareness training. What is the difference between the traditional security awareness training that you are, Robert Siciliano ProtectNowLLC: Well essentially we are training them holistically on what it what it what security actually means. So I asked them like really basic questions, like, you know, how many of you can honestly say that like you're using these passcodes, you know, the same passcode across multiple accounts? And as they're answering those questions, you know, you know, I asked them, like, how many of you have a home security system? And if I get 10% of the room to answer their yes, that's a lot. And I say, Well, why don't you have that home security system? And they say, Well, I don't have a home security system because I don't want to live in fear. I don't want to be paranoid. And you're like, well, Why would you think that security is about paranoia? And you begin to explain what actually paranoia is, which is actually a mental health issue. And they're like, whoa, I didn't realize that. I didn't realize that my entire life I've been associating security, which is ultimately a good thing, with a mental health issue, which is a disease of the mind. And as you engage in this belief-challenging dialogue, before you know it, people like want more security in their life. That's a dialogue that most people have never actually had. And most training doesn't do that at all. Julius Neil Buenconsejo: so whatever we talk about cybersecurity, it's becoming now more dangerous because of AI. So for years, we've told that we be careful about SMS text and then there's a link. Even, you we've told people about don't trust email with this type of links and asking for, you know, private information. And now we have AI generating convincing emails, know, clone voices and deep fake videos that you mentioned a while ago. What happens when seeing isn't believing anymore? Robert Siciliano ProtectNowLLC: Yeah, we can't even trust ourselves, because the way in which AI makes us react, the same way that you know, a human would make us react. AI today feels 100% human. Deep fakes, voice clones. It feels just like your daughter calling you, or your spouse, or your CEO contacting you. Like it feels the same way that a regular real phone call would, or email, or text message, or video call like this. and that's problematic. And that's where the triple A protocol comes in, especially when that Communication involves the transfer of any money whatsoever, which ninety nine out of a hundred times is the motivation of all fraud today. Julius Neil Buenconsejo: does AI change about the human vulnerability problem versus 10 years ago and currently right now? Robert Siciliano ProtectNowLLC: Well the change, of course, is that it it enhances it. it it makes the the fraud, the scam, the ruse feel a hundred percent human. And you know, blunder force fishing with scrammer scammer grammar is no longer the default. Now it's you know perfect AI using neural puppetry to create perfect clones. And the human cannot tell the difference. And if they're not engaged in, you know, becoming a strategic human firewall and adopting the triple A protocol, understanding their own human blind spot, then they are more at risk. because of AI deep fakes and voice cloning, the real the realism of it is indistinguishable from you know real or fake Julius Neil Buenconsejo: What's the most dangerous AI-powered social engineering attack companies aren't preparing? Robert Siciliano ProtectNowLLC: All of it, every bit of it. Voice clones, deep fake videos, they're not preparing for that at all. There's no there's no effective dialogue occurring internally that I've seen to prepare the employee for what to look out for. There just isn't. Julius Neil Buenconsejo: give me three scenarios for example for CEO, CIO, and a police should be training for right now in the age of AI. Robert Siciliano ProtectNowLLC: I would say right now we need to bring it back to the basics. If you want to get your employees up to speed in regards to security and get them to appreciate the value security has in their life, to get them to actually effectively react every time the phone rings, they get a text message and email or a pop up or they engage in a video call with the colleague, then you need to teach them personal protection first. Meaning, literally, teach them how to protect their own identities. Teach them how to protect their child's digital footprint. Teach them how to manage their own passwords. Why? Why would you do that? If AI is the problem, why would you teach them about password? Password management because they don't even want to begin to think or even recognize the risks AI has in their own lives. They don't even think security is their responsibility to begin with. But when you teach them personal protection, they begin to become more interested in security. Look at I'll ask you a question. When you're in an airplane and the flight attendant is providing you safety instructions, and she says to you, hey, When the oxygen mass comes down, let me ask you, Julius, what do you do first? Julius Neil Buenconsejo: What do mean? When it comes down? Then I just grab Robert Siciliano ProtectNowLLC: Yeah. Julius Neil Buenconsejo: it here. Robert Siciliano ProtectNowLLC: And what do you wh wh what do you do? What do you do? When the oxygen mass comes down, what do you do first? Julius Neil Buenconsejo: And then react, get it? then... Robert Siciliano ProtectNowLLC: You're supposed to put it on yourself first. Julius Neil Buenconsejo: Yes, yes. Robert Siciliano ProtectNowLLC: Okay? And why is that? Because when it comes to your safety, when it comes to your security, you've got to take care of yourself first. If you don't put that oxygen mask on yourself first versus like helping the person next to you, if you don't put it on yourself first, you're not gonna be able to breathe. And if you can't breathe, you can't help the person next to you. You see how that works? And so Julius Neil Buenconsejo: Mmm. Yeah, yeah. Robert Siciliano ProtectNowLLC: when it comes to security, we have to take care of ourselves first. first and once we do that as employees we become more effective in a corporate environment. Julius Neil Buenconsejo: So do you think this social engineering ultimately unattacked on the technology itself or unattacked to the human trust? Robert Siciliano ProtectNowLLC: Social engineering truly is an attack on human trust. It's a it's attack attacks on human belief systems. It's attacks on what humans know or think to be real. It's an attack using cognitive tunneling, manufactured urgency. It's an attack using in weaponizing human trust. Julius Neil Buenconsejo: so a hypothetical scenario. You're sitting in front of a CEO right now and a board. And then they give you 60 seconds to explain human cyber risk. What do you say? Robert Siciliano ProtectNowLLC: I say sit your your people down and have a dialogue with them. You know, understand their fears, understand their worries, understand their concerns, and actually, you know, provide tactical and simple solutions to what those fears and worries are. Actually engage in a dialogue to alleviate those fears and give them actually tools they can use going forward. Look at security can be a really scary thing to people that don't quite understand it. And the CISO and the CTO and the CIO, they understand it. And they wonder why their employees keep clicking the links to the emails that they think is Amazon and it's not Amazon. It's because the employees have never had an effective dialogue with a security professional before, truly. And most people just don't know. It's not their profession. They don't understand it. Most people have never had. an in-depth conversation about security with a security professional. And as a result, they don't have any answers, but they have all kinds of questions. Julius Neil Buenconsejo: I'll have the rapid 10x round, what's one AI tool you actually use every day? Robert Siciliano ProtectNowLLC: I love Google's Gemini. it has its limitations. It doesn't always work the way I want it to, but I use Google Gemini on a regular basis due to the fact that it's embedded in most Google tools that I use. Julius Neil Buenconsejo: what's one AI task has already 10x in your life? Robert Siciliano ProtectNowLLC: I would certainly say as a research tool, Google Gemini and other AI tools have taken the fight out of problem solving. Julius Neil Buenconsejo: what's human skill? AI can every place. Robert Siciliano ProtectNowLLC: Reasoning with another human. It can't do that. Julius Neil Buenconsejo: if you could automate one annoying thing forever, what would it be? Robert Siciliano ProtectNowLLC: If I could I would say Editing an email, just do it automatically for me. Julius Neil Buenconsejo: What's the biggest misconception about AI right now? Robert Siciliano ProtectNowLLC: I don't know that it's gonna kill us in ten years. I think it I think we're gonna be fine. Julius Neil Buenconsejo: what advice would you give someone who wants to become 10x starting today? Robert Siciliano ProtectNowLLC: So I would say take a c a basic class on how to use artificial intelligence to enhance your own personal life and take those same skills to enhance your professional life. Julius Neil Buenconsejo: what would you tell your younger self about the future? Robert Siciliano ProtectNowLLC: that it's important to do your homework, to to to take care of your mind and your body and to take time to take a walk in the grass because it's not all about technology. Julius Neil Buenconsejo: what's one book, podcast, or resource that shaped your thinking about AI or innovation? Robert Siciliano ProtectNowLLC: there's a book by a guy named Robert Cialdini about persuasion. And if you look up Robert Cialdini and Persuasion, it talks all about how social engineering essentially is being used in the in the analog world to compromise humans, in the same s the same persuasion skills are being used in the digital world. Julius Neil Buenconsejo: if you had to bet on one AI trend that will be massive in three years, what is it? Robert Siciliano ProtectNowLLC: I think that we're gonna all be using an AI agent, we're gonna have a digital twin, and it's going to I think alleviate a lot of the mundane administrative tasks that we use on a regular basis. Julius Neil Buenconsejo: in one sentence, what does 10x mean to you personally? Robert Siciliano ProtectNowLLC: I think ten X for me is finding more time u using technology so that I can find more time to spend with my family. Julius Neil Buenconsejo: that's great. That's good. So where can people connect with you or learn more about your work? Robert Siciliano ProtectNowLLC: I am online like everybody else at protectnowlc Julius Neil Buenconsejo: Mm-hmm. Robert Siciliano ProtectNowLLC: dot com. Again, that's protectnowlc dot com. Julius Neil Buenconsejo: so again, thank you very much for your time and then for for all the viewers and listeners right now Thanks for watching 10xai. Remember the feature doesn't belong to AI it belongs to the people who use it. See you next episode